🚀 go-pugleaf

from alt.security.  comments from the FSF are welcomed, refer back to
the original article for details.

I note that the amiga software archives at ab20.larc.nasa.gov have
been closed to access from ai.mit.edu because of these activities.

--Ed
Edward Vielmetti, member of the League for Programming Freedom, emv@msen.com

In article <2379@wzv.win.tue.nl> wietse@wzv.win.tue.nl (Wietse Venema) writes:

   The TimeWasters is a group of students (and one former student, Rob J.
   Nauta) of Eindhoven University, located in the Netherlands.  Their
   computer accounts at the Free Software Foundation have been used to
   attack and to breach the security of several University computer
   systems throughout the US, Canada and Europe. The intruders exploited
   the fact that Dutch law against computer crime is still in preparation.

   Dutch Law or not, such activities are criminal.  The activities of the
   intruders have been monitored for quite some time.  And because it will
   take some time before Dutch law will cover computer crime, I am
   provoking an open discussion of the problem.  Sooner or later the
   intruders would have found out about the monitoring, anyway.  My
   statements are based on several tens of megabytes of data which I have
   passed on to the proper US and Dutch authorities.

   As an illustration, this is the case history of the password stealing
   program:

   March 13: fidelio writes the initial version of the password stealing 
	   program. 

   March 14,15: The password stealing program is "tested" on several US 
	   university systems. Dozens of passwords are captured.

   March 15: The CERT security organization is alerted by me. CERT, in turn,
	   notifies Sun Microsystems and other vendors.

   March 18,19: Several versions of the password stealing program are 
	   uploaded to our systems and several passwords are captured.
	   Each day I have to make minor adjustments to our networking
	   software.

   March 19: In an attempt to delay further development of the program, I mail 
	   a "what's this?" message to the TimeWasters group, together with a 
	   version of the program that contains several references to the name 
	   of the group.

	   A few hours later, fidelio submits a bug report with the password
	   stealing program as "proof" of the bug.

   March 21: A fixed telnet daemon is available from Sun. Later fixes follow 
	   for other releases of the SunOS operating system.

   All the time, victims of these and other activities were notified
   either directly by me or through the CERT security organization.

   Note that I have given fidelio ample time to revoke his statement that
   he is the author of the password stealing program, in case the article
   was posted under his name by someone else.

   Of course, all this is just my personal view.  For an independent view,
   contact {fidelio,belgers,wevers,erlend}@gnu.ai.mit.edu.

	   Wietse Venema
	   Eindhoven University of Technology
	   The Netherlands